Thread: Memory Search Function

Here's the original C++ function

PHP Code:

// http://en.wikipedia.org/wiki/Boyer-Moore-Horspool_algorithm
LPBYTE PatchSearch(HMODULE hModule, LPBYTE searchCode, int size, BYTE wildcard) {
    size_t skipLength[UCHAR_MAX + 1];
    int scan;

    int lastByte = size - 1;
    while(searchCode[lastByte] == wildcard)
        lastByte--;

    int defaultSkip = lastByte;
    for(scan = 0; scan < lastByte; scan++) {
        if(searchCode[scan] == wildcard) {
            defaultSkip = lastByte - scan;
        }
    }

    if(defaultSkip > 1) defaultSkip--;
    for(scan = 0; scan < (UCHAR_MAX + 1); scan++)
        skipLength[scan] = defaultSkip;

    for(scan = 0; scan < lastByte; scan++) {
        if(searchCode[scan] != wildcard) {
            skipLength[searchCode[scan]] = lastByte - scan;
        }
    }

    MODULEINFO dllInfo;
    GetModuleInformation(GetCurrentProcess(), hModule, &dllInfo, sizeof(dllInfo));

    LPBYTE p = (LPBYTE)dllInfo.lpBaseOfDll;
    LPBYTE searchEnd = (LPBYTE)dllInfo.lpBaseOfDll + dllInfo.SizeOfImage;
    searchEnd -= lastByte + 1;

    while(p <= searchEnd) {
        scan = lastByte; 
        while(searchCode[scan] == wildcard || p[scan] == searchCode[scan]) {
            if(scan == 0) return p;
            scan--;
        }
        p += skipLength[p[lastByte]];
    }

    return NULL;
} 


that code looks basic.

You just have to figure out what everything means.. and find same thing in delphi like..

UCHAR_MAX
you google this you find
#define UCHAR_MAX 255

so this line mean
size_t skipLength[255 + 1];
or
size_t skipLength[256];

then size_t could mean anything

then you look at this

skipLength[scan] = defaultSkip;
and then you see
int defaultSkip = lastByte;
so skipLength is int
int skipLength[256];

maybe problems with parameters too

like
LPBYTE searchCode
well.. LPBYTE is declared as

typedef byte* LPBYTE

then what is byte?

typedef unsigned char BYTE;

okay now you know BYTE means unsigned char.. and LPBYTE means unsigned byte pointer..

so we know
LPBYTE searchCode
is.. byte array of unsigned bytes..

byte[] searchCode //<- in C#.

we also now know..
BYTE wildcard is also unsigned char so,..
byte wildcard //<- in C#.

HMODULE hModule
typedef HINSTANCE HMODULE; //<-- see HMODULE mean HINSTANCE
typedef HANDLE HINSTANCE; //<- HINSTANCE mean HANDLE
typedef PVOID HANDLE; //<- HANDLE is PVOID
typedef void* PVOID; //<- PVOID is VOID * [void pointer]

Void pointer is a pointer that is pointing to any type of unknown data.. then you can cast it to anything you wish char,int,float, you must know what data you put in kind of pointer or else you might forget about it.

This doesn't explain much, but.
HMODULE and HINSTANCE = Base Address of DLL or EXE which is loaded in memory, it is a unsigned long pointer.

I think Delphi supports HMODULE and HINSTANCE.. or either one should work, if not it is just unsigned long pointer.. or from googling same as ^LongWord

Other than that nothing really to hard about that example.
Have to figure out how API works in delphi for GetModuleInformation it should be found in Win32API, I think this can be googled easily with "WIN32API GetModuleInformation Delphi" found example something like this

Okay it seems.. hModule should be in Delphi THandle

Lol delphi looks horrible something like this.. I don't know if this will work..

Code:

var
  dllInfo: TModuleInfo;
begin
  GetModuleInformation(GetCurrentProcess, hModule, @dllInfo, SizeOf(dllInfo));
end;

then pretty much

LPBYTE p = (LPBYTE)dllInfo.lpBaseOfDll;
LPBYTE searchEnd = (LPBYTE)dllInfo.lpBaseOfDll + dllInfo.SizeOfImage;

LPBYTE p is pointer to byte array which starts at dllInfo.lpBaseOfDll.
searchEnd is p which is where base address starts for dll and plus sizeOfImage of dll which gets the address where base address ends.

Hope it helps.. probably Dwar will do it all for you anyways.

If you look at the original post, you will see i did try to do much of what you said in figuring out the the delphi equivalent.
I've done something wrong in there, i think it's the pointer arithmetic and perhaps BaseDLL / size of image.

I'll review what i wrote and look at your suggestions.

Btw pkedpker... who are you from SubSpace??

I look into that code after work (2nd day working for a new Web design company) as it's 1:30pm here.

And i remember your username from Continuum, did you make a couple of maps also back in the day?

Don't count on it compiling, I just pieced together some text from your source code.. not even understanding like what is Cardinal or how arrays work in Delphi.
@SS
Yeah I made a few maps for tw.. forgot which meh not important non ever got popular.. and who cares really lol.

Good job man webdesign you must be very good artist.